Bug 1693245

Summary: SELinux: mariadb-server-galera
Product: Red Hat Enterprise Linux 8 Reporter: Michal Schorm <mschorm>
Component: mariadbAssignee: Michal Schorm <mschorm>
Status: CLOSED ERRATA QA Contact: Anna Khaitovich <akhaitov>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.0CC: akhaitov, databases-maint, hhorak, kvolny, lmiksik, vdanek
Target Milestone: rc   
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: Missing SELinux rule(s) Consequence: MariaDB cluster couldn't be set up without manually adding appropriate SELinux rules to all nodes machines. Fix: Added / Fixed SELinux rules in selinux-policy package Result: SELinux will not block standard setup of MariaDB cluster
 Story Points: ---
Clone Of:
: 1732381 (view as bug list) Environment:
Last Closed: 2020-03-04 10:04:40 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1732381    

Description Michal Schorm 2019-03-27 11:33:44 UTC 
You can use instructions from here:
https://bugzilla.redhat.com/show_bug.cgi?id=1522636#c5

to setup the cluster.

If you enable SELinux on any of the cluster nodes, it will make problems.
Comment 2 Karel Volný 2019-04-02 13:12:11 UTC 
FTR, trying to run the automated test, I got this:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31
selinux-policy-3.14.1-61.el8.noarch
----
time->Tue Apr  2 05:45:51 2019
type=PROCTITLE msg=audit(1554198351.207:515): proctitle="ifconfig"
type=SYSCALL msg=audit(1554198351.207:515): arch=c00000b7 syscall=48 success=no exit=-13 a0=ffffffffffffff9c a1=aaaaba88e2a0 a2=4 a3=2 items=0 ppid=23534 pid=23580 auid=4294967295 uid=27 gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 tty=(none) ses=4294967295 comm="ifconfig" exe="/usr/sbin/ifconfig" subj=system_u:system_r:mysqld_t:s0 key=(null)
type=AVC msg=audit(1554198351.207:515): avc:  denied  { search } for  pid=23580 comm="ifconfig" name="net" dev="proc" ino=3284 scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0